From c612aa77c2d04aa8052f89e17eea8b255491e297 Mon Sep 17 00:00:00 2001
From: Maris Popens <maris@popens.lv>
Date: Sat, 19 Sep 2026 22:54:59 +0300
Subject: [PATCH] ci: cut redundant Actions runs, add required-check gate job

---
 .github/dependabot.yml                      |  2 +-
 .github/workflows/ci.yml                    | 15 +++++++++++----
 .github/workflows/dependabot-auto-merge.yml |  7 ++++++-
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9017dbb..20e6e2c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,7 +6,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     groups:
       actions:
         patterns: ["*"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 703c9d1..29c0952 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,10 +5,6 @@ name: CI
 # waits on before enabling auto-merge.
 
 on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "**/*.md" # the daily profile refresh only touches README.md
   pull_request:
     branches: [main]
 
@@ -50,3 +46,14 @@ jobs:
               yaml.safe_load(open(f))
               print("ok", f)
           PY
+
+  # Single stable name for the org's required-status-check ruleset to point
+  # at, regardless of how the real jobs above are split or renamed.
+  required-checks-passed:
+    name: Required checks passed
+    runs-on: ubuntu-latest
+    needs: [actionlint, scripts]
+    if: always()
+    steps:
+      - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 526be02..eb69d25 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -21,5 +21,10 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    if: github.event.workflow_run.conclusion == 'success'
+    # Every other actor's CI completion used to match this too, spinning up
+    # the reusable workflow (and its PR lookup) just to no-op - narrowing the
+    # trigger itself to the only actor that can ever be eligible below.
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
     uses: drumandbytes/reusable-actions/.github/workflows/auto-merge.yml@v1